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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings of claims in the application: 
Listing of Claims: 

1 . (Currently amended) A method for detecting a spoofed network 
connection [[s]] comprising: 

receiving a connection from a client; 

delaying sending a greeting message for a delay period , the delay period being 
less than or equal to a maximum tolerable delay, the maximum tolerable delay being the longest 
delay that would be tolerated by a valid client ; 

monitoring the connection during the delay period; and 
if a command is received from the client before the greeting is sent, then 
identifying the connection as a possible the spoofed connection. 

2. (Original) The method of claim 1 further comprising: 
sending the greeting to the client upon completion of the delay period. 

3. (Currently amended) The method of claim 1 further comprising: 
processing any electronic mail associated with [[a]] the spoofed connection. 

4. (Currently amended) The method of claim 3 wherein el e ctronic mail 
associat e d with a spoofed connection a spoofed-connection electronic-mail message is processed 
using a process selected from the group consisting of: 

deleting a spoofed connection e l e ctronic; the spoofed-connection electronic- mail 

message; 

marking a spoof e d conn e ction el e ctronic the spoofed-connection electronic- mail 

message; and 

storing a spoofed connection el e ctronic the spoofed-connection electronic- mail 
message in an speeial-electronic directory. 
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5. (Original) The method of claim 1 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

6. (Original) The method of claim 1 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 

7. (Original) The method of claim 1 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 

8. (Currently amended) A method for detecting a spoofed network 
connection[[s]] comprising: 

receiving a first command at a server from a client; 

delaying, for a delay period, a transmission of a reply associated with the first 
command , the delay period being less than or equal to a maximum tolerable delay, the maximum 
tolerable delay being the longest delay that would be tolerated by a valid client ; 

monitoring a connection between the server and the client during the delay period; 

and 

if a second command is received at the server before the reply is transmitted, then 
identifying the connection as a possibl e the spoofed connection. 

9. (Original) The method of claim 8 further comprising: 

sending a greeting to the client when the connection is established with the server. 

10. (Original) The method of claim 8 further comprising: 
transmitting the reply upon completion of the delay period. 

1 1 . (Original) The method of claim 8 further comprising: 
processing any electronic mail associated with the spoofed connection. 

12. (Original) The method of claim 8 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 
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1 3 . (Original) The method of claim 8 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 

14. (Original) The method of claim 8 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 

15. (Currently amended) An apparatus for detecting a spoofed connection[[s]] 

comprising: 

means for detecting when a connection is established between the apparatus and a 

client device; 

means for transmitting a greeting message or a reply or both to the client device; 

means for delaying the transmitting means so that the greeting message or the 
reply or both are not transmitted during a delay period , the delay period being less than or equal 
to a maximum tolerable delay, the maximum tolerable delav being the longest delay that would 
be tolerated by a valid client ; and 

means for monitoring the connection to detect commands that are sent by the 
client device at least during the delay period. 

1 6. (Original) The apparatus of claim 1 5 wherein the client device is a Mail 
Transfer Agent (MTA) or Mail User Agent (MUA). 

1 7. (Original) The apparatus of claim 1 5 wherein the detecting means, the 
transmitting means, the delaying means, and the monitoring means comprise one or more 
processor-based devices running software algorithms to provide the detecting, transmitting, 
delaying and monitoring functions. 

1 8 . (Original) The apparatus of claim 1 5 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

19. (Original) The apparatus of claim 15 wherein the commands are Simple 
Mail Transfer Protocol (SMTP) commands. 
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